Privacy policy
The website Primrose.be is offered by:
Ceres Pharma
Kortrijksesteenweg 1091 bus B,
9051 Sint-Denijs-Westrem
Belgium
Company number (VAT-BE): BE0641.953.324
E-mail : info@ceres-pharma.com
Phone : 0032 9 296 47 70
Feel free to contact us should you have any privacy-related questions. We promise to reply soon!
1. WHY THIS PRIVACY STATEMENT?
Every person (hereafter the “User”) who visits or uses the Website discloses a certain amount of personal data. The personal data is information which allows ceres-pharma.com to identify you as a natural person, regardless of whether we actually do this. You are identifiable as soon as it is possible to create a direct or indirect link between one or more data and you as a natural person.
We only use and process your personal data in accordance with the GDPR and any replacement legislation, or any similar regulation under any applicable law, and any regulatory requirements or codes of practice governing the use, storage or transmission of personal data. Every reference in this Privacy Statement to the ‘GDPR’ is a reference to the Regulation of 27 April 2016 on the Protection of Natural Persons with regard to the Processing of Personal Data and on the Free Movement of such Data (General Data Protection Regulation).
Through this Privacy Policy, every User of the Website is informed of the processing activities ceres-pharma.com may carry out with his or her personal data. ceres-pharma.com reserves the right to modify this Privacy Policy at all times. Every substantial change will be clearly communicated towards the User. We advise you to consult this document regularly.
2 WHO IS RESPONSIBLE FOR THE PROCESSING OF PERSONAL DATA?
2.1. CONTROLLER
Ceres-pharma.com is responsible for the processing and decides alone or in cooperation with others which personal data are being collected as well as the purposes and the technical and organisational means with regard to the processing of those personal data.
2.2. PROCESSOR(S)
Ceres-pharma.com is free to rely on data processors. A processor is the natural or legal person who processes your personal data upon request and on behalf of the data controller. The processor is required to ensure the security and confidentiality of the data. The processor shall always act on the instructions of the data controller.
Ceres-pharma.com relies on the following categories of "processors":
• Companies we have engaged for marketing purposes;
• Companies we have engaged for hosting purposes;
• Companies we have engaged for administrative purposes;
• Companies we have engaged for communication purposes;
• Companies we have engaged for statistical purposes;
• Companies we have engaged for payment purposes.
3 ON WHAT LEGAL GROUNDS ARE MY DATA PROCESSED?
In accordance with the GDPR we process personal data on the following legal grounds:
• On the basis of the execution of the contract agreed upon with you or the execution of pre-contractual steps taken at your request; or
• On the basis of compliance with legal or regulatory provisions with regard to the management of the contractual relationship, invoicing in particular;
• On the basis of our legitimate interest in sending information and newsletters to our customers;
• On the basis of your consent to send promotional offers (direct marketing).
4 WHICH PERSONAL DATA ARE BEING PROCESSED?
Ceres Pharma commits to only collect and process adequate, relevant and limited to what is necessary for the purposes for which they are processed. The following categories of personal data are processed by Ceres-pharma.com:
• Personal identification data (name, first name, address, login details);
• Contact details (telephone number and e-mail address);
• Financial identification data (bank details);
• Electronic identification data (IP address, location, cookies);
• Personal data (gender, age, date and place of birth, nationality).
• …
This data is collected at the time of your registration on the Website and when you use our services. Other personal data may be collected later, e.g. in the context of our after-sales. These data are necessary for the provision of Ceres Pharma services. The amount of personal data collected depends on your use of the Website and the functionalities of the Website.
We also use cookies in order to recognise the User and to offer the User a personalised user experience, to remember technical choices (for example, language choices or a shopping cart), and to detect and correct any errors which might be present on the Website.
For more information concerning the use of cookies, we kindly refer you to our Cookie Statement.
5 FOR WHICH PURPOSES ARE MY PERSONAL DATA BEING USED?
Ceres Pharma collects your personal data for the sole purpose of offering every User of our a safe, optimised and personal user experience of our Website and the offered services. The collection of personal data becomes more extensive as the User makes more intensive use of our Website and our online services. Ceres Pharma reserves the right to suspend or cancel certain operations if personal data is missing, incorrect or incomplete.
The processing of your personal data is essential for the proper functioning of the Website and the provision of associated services. Ceres Pharma commits to solely process your personal data for the following purposes:
Customer management: customer administration, order management, deliveries, invoicing, checking creditworthiness, support, complaint monitoring and sending newsletters.
Dispute management.
Protection against fraud and infringements.
Personalized marketing and advertising if you have expressly agreed to it. In that case, you are free to withdraw your consent at any time.
When visiting the website of Ceres Pharma, some data are being collected for statistical purposes. Such data is necessary to optimise your user experience. These data are: IP-address, probable location of consultation, hour and day of the consultation and the pages which are being consulted. When you visit the Website, you explicitly agree to this collection of data for statistical purposes.
The User provides the personal data to Ceres Pharma himself and can therefore exercise some kind of control. When certain data is incomplete or apparently incorrect, the User has the right to postpone some expected actions temporarily or permanently.
6 WHO RECEIVES YOUR PERSONAL DATA?
Your personal data are processed for internal use within Ceres-pharma.com only. Your personal data will not be sold, passed on or communicated to any third parties, except in case you have given us your explicit prior consent.
7 HOW LONG DO WE STORE YOUR PERSONAL DATA?
Your data is stored as long as necessary to achieve the ends pursued. They will be erased from our database as soon as they are no longer necessary for the ends pursued or if you validly exercise your right to erasure.
8 WHAT ARE MY RIGHTS?
8.1 GUARANTEE OF A LEGITIMATE AND SECURE PROCESS OF YOUR PERSONAL DATA
Your personal data are always processed for the legitimate purposes explained in point 5. They are collected and processed in an appropriate, relevant and non-excessive manner, and are not kept longer than necessary to achieve the intended purposes.
8.2 RIGHT TO ACCESS
If you can prove your identity, you have the right to obtain information about the processing of your data. Thus, you have the right to know the purposes of the processing, the categories of data concerned, the categories of recipients to whom the data are transmitted, the criteria used to determine the data retention period, and the rights that you can exercise on your data.
8.3 RIGHT TO RECTIFICATION OF YOUR PERSONAL DATA
Inaccurate or incomplete personal data may be corrected. It is primarily the responsibility of the User to make the necessary changes in his "user area" himself, but you can also request us in writing.
8.4 RIGHT TO ERASURE (OR “RIGHT TO BE FORGOTTEN”)
You also have the right to obtain the erasure of your personal data under the following assumptions:
Your personal data are no longer necessary for the intended purposes;
You withdraw your consent to the processing and there is no other legal ground for processing;
You have validly exercised your right of opposition;
Your data has been illegally processed;
Your data must be deleted to comply with a legal obligation.
The deletion of data is mainly related to visibility; it is possible that the deleted data are still temporarily stored.
8.5 RIGHT TO LIMITATION OF PROCESSING
In certain cases, you have the right to request the limitation of the processing of your personal data, especially in case of dispute as to the accuracy of the data, if the data are necessary in the context of legal proceedings or the time required to Ceres-pharma.com to verify that you can validly exercise your right to erasure.
8.6 RIGHT TO OBJECT
You have the right to object at any time to the processing of your personal data for direct marketing purposes. XXX will stop processing your personal data unless it can demonstrate that there are compelling legitimate reasons for the processing which prevail over your right to object.
8.7 RIGHT TO DATA PORTABILITY
You have the right to obtain any personal data which you have provided us in a structured, commonly used and machine readable format. At your request, this data may be transferred to another provider unless it is technically impossible.
8.8 RIGHT TO WITHDRAW YOUR CONSENT
You may withdraw your consent to the processing of your personal data at any time, for example for direct marketing purposes.
9 HOW TO EXERCISE MY RIGHTS?
If you wish to exercise your rights, you must send a written request and proof of identity by registered mail to Ceres Pharma, Kortrijksesteenweg 1091 bus B, 9051 Sint-Denijs-Westrem, Belgium or by email to info@ceres-pharma.com We will respond as soon as possible, and no later than one (1) month after receipt of the request.
10 POSSIBILITY TO LODGE A COMPLAINT
If you are not satisfied with the processing of your personal data by Ceres Pharma, you have the right to lodge a complaint with the competent Data Protection Authority (for Belgium: https://www.privacycommission.be/).
Privacy Statement for Pharmacovigilance
As a pharmaceutical company, Ceres Pharma Benelux has a legal responsibility to monitor the safety of all products worldwide that we develop, produce or market. With the following information, we would like to inform you which personal data we process in the context of so-called pharmacovigilance and for which purposes we use this data. The scope of this statement is limited to the collection and processing of your personal data for pharmacovigilance and/or medical information inquiries. For general information about data processing at Ceres Pharma Benelux please visit: Ceres Pharma Benelux Privacy Policy
The monitoring of adverse reactions, side effects and/or interactions with other medicinal products (“event”) associated with the use of medicinal products is known as pharmacovigilance. The legally defined pharmacovigilance obligations relate to our medicinal products and allow us and the competent regulatory authorities to record events and to collect, process or use personal data in this respect. Comparable regulations exist for our medical devices and cosmetics. In the following, we therefore use the term pharmacovigilance comprehensively for the above-mentioned products.
In order to fulfil our legal responsibilities in this respect, we must collect and process information that allows a natural person to be identified, directly or indirectly ("personal data"), from a patient brought to our attention and/or the person reporting such an event. Under certain conditions, we also must report these events to the relevant regulatory authorities. In case such an event occurs, we ensure that all personal data is processed exclusively for pharmacovigilance purposes and only where relevant and appropriate in order to document, assess and report the event properly in accordance with our respective pharmacovigilance obligations.
In order to safeguard this personal data, we have implemented appropriate state of the art technical and organizational measures.
Legal basis
The legal basis for the processing of your personal data is the fulfilment of our legal obligations regarding the applicable pharmacovigilance laws and regulations, respectively the safeguarding of the considerable public and our own legitimate interests, which consist in ensuring high safety and quality standards for our products (Art. 9 Para. 2 lit. i GDPR, Art. 6 Para. 1 lit. c GDPR / Art. 6 Para. 1 lit. f GDPR in conjunction with Section 22 para. 1 lit. c BDSG).
Categories of personal data
We may need to process the following personal data (including collection, storage and further use, hereinafter together “process”):
About the patient affected by the event
Where appropriate, we can process the following additional personal data related to health and medical history of the person experiencing such an event if and to the extent this is required to process the event for pharmacovigilance purposes:
Name and/or initials of the patient,
Date of birth/age group, sex, weight, height
Information on health, racial or ethnic origin and sexual life
Medical history and state of health, including, but not limited to, for example:
Details of the product suspected of having caused the event, including the dosage you have been taken or were prescribed, the reason for taking or prescribing the product, and any subsequent changes to your usual medical therapy;
Details of any other medicines or medications you are taking or were taking at the time of the event, including the dosage you have been taking or were prescribed, the period you were taking the medicine, the reason for taking the medicine and any subsequent changes to your medical therapy,
Details of the event that you suffered, the treatment you received for that event, the potential long-term effects of the event on your health, and any other information about your medical history that the reporter considered relevant, including documents such as laboratory reports, medication history and patient history.
About the person reporting the event to us:
With respect to the person which has reported the event to us we can process the following data, in order to allow further inquiries by the regulatory authorities and or to further investigate the event:
Name,
Contact details (e.g. which may include, but not limited to, your address, e-mail address, telephone or fax number),
Profession (this information may determine the questions you are asked about the event, depending on the assumed level of your medical knowledge about the event), and
Relationship to the subject of the report.
Purposes of the processing
As part of meeting our pharmacovigilance obligations, we may process personal data in order to
investigate the event,
contact you to obtain further information about the event you reported,
compare the information on the event with information on other events reported to us and, on this basis, analyse the safety of a production batch, product or active substance as a whole, and
to provide mandatory reports to national and/or regional competent regulatory authorities to enable them to analyse the safety of a production batch, product, generic ingredient or active substance as a whole, together with reports from other sources. These reports contain details about the reported incident but will only contain limited personal data of the patient (note that the name of the patient will never be provided).
Transfer of personal data
As part of meeting our pharmacovigilance obligations, we may share and/or disclose personal data as follows:
within the Ceres Pharma Benelux group to analyse and process a reported event.
with the competent regulatory authorities, with regard to a suspected event.
with third-party service providers of the Ceres Pharma Benelux group. Appropriate data protection security measures are implemented at our service providers to whom we pass on personal data and who are providing services on our behalf.
with other pharmaceutical companies acting as co-marketers, co-distributors or other licensing partners, where the pharmacovigilance obligations for such a product require such exchange of safety information. Please note that also in this case appropriate data protection security measures are implemented at these business partners.
with legal successors if the company, a therapeutic area or a specific product is sold, assigned, transferred or taken over by a third party. In this case we will require this third party to process personal data only in accordance with the applicable data protection law.
if information about events is published (for example, in the form of case studies and summaries); in these cases, all identifiers are removed from publications to keep your identity private.
Third countries
Our pharmacovigilance databases are hosted in Germany. A transfer to third countries (outside the EU/EEA) may take place to the following recipients or categories of recipients due to compliance with the statutory reporting obligations:
Subsidiaries of the Ceres Pharma Benelux Group which are established in a third country,
Distributors and, where appropriate, other companies (established in a third country) acting as co-marketers, co-distributors or other licensing partners, where the pharmacovigilance obligations for a product require such exchange of safety information.
Competent authorities.
Retention periods
We will use and store the personal data collected according to the aforementioned requirements in accordance with the respective mandatory and other legal requirements governing the storage and reporting of pharmacovigilance related information. Such mandatory requirements currently oblige us to archive the respective pharmacovigilance information, which may include personal data for the duration of the product life-cycle (i.e. until the respective product has been taken from the market) and for an additional ten years thereafter.
Your rights as data subjects
If we process personal data, the persons concerned are entitled to the following rights:
Art. 15 GDPR Right to information
Right to information about your personal data stored by us.Art. 16 GDPR Right of rectification
Right to rectification of incorrect or incomplete personal data concerning you.Art. 17 GDPR Right to deletion
Deletion of your personal data unless there is a legal obligation to keep records.Art. 18 GDPR Right to restrict processing
If certain conditions are met, you have the right to have your personal data blocked and not processed further.Art. 20 GDPR Right to data transferability
The right to data transferability of personal data concerning you that you have provided to us.
Please note, however, that these rights may be limited in order to fulfil our legal obligations. Your rights are not fully applicable if there is a legal basis for the processing of your personal data (e.g. information collected in the context of reporting an event cannot be deleted unless it is incorrect).
There is no automated decision-making including profiling according to Art. 22(1) and (4) GDPR.
Data subjects also have the right to file a complaint with a data protection authority.
Contact details of the data protection officer
For any questions you may have with respect to pharmacovigilance data protection or data protection in general please contact our data protection officer:
by registered mail to Ceres Pharma Benelux, Kortrijksesteenweg 1091 bus B, 9051 Sint-Denijs-Westrem, Belgium
by email to info@ceres-pharma.com.